From efd1ebc7f2530af7a1e86580e9f01d1e46b5cac7 Mon Sep 17 00:00:00 2001
From: digi-scrypt <digicrypt@gmail.com>
Date: Fri, 5 Jun 2026 20:46:21 +0530
Subject: [PATCH] check snappy block length before crc trailer in decode_snappy

---
 lang/c/src/codec.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/lang/c/src/codec.c b/lang/c/src/codec.c
index 176fb21d657..fa926628ebe 100644
--- a/lang/c/src/codec.c
+++ b/lang/c/src/codec.c
@@ -142,6 +142,11 @@ static int decode_snappy(avro_codec_t c, void * data, int64_t len)
         uint32_t crc;
         size_t outlen;
 
+        if (len < 4) {
+		avro_set_error("Snappy block is too small to contain a CRC32 checksum");
+		return 1;
+        }
+
         if (snappy_uncompressed_length((const char*)data, len-4, &outlen) != SNAPPY_OK) {
 		avro_set_error("Uncompressed length error in snappy");
 		return 1;